CCPA Outline in 2026: An 8-Part Privacy Program Map for Business Teams
People searching for ccpa outline usually do not want another abstract summary. They want a clean way to organize the work: what to inventory, what to disclose, what consumers can ask for, and what California regulators are now paying attention to.
This version is built for that use case. If you need the foundation first, start with our CCPA basics guide and our deeper scope explainer on CCPA who it applies to. If your next problem is website implementation, our CCPA cookie consent guide covers the opt-out layer. This article is narrower: a practical outline you can use to review a California privacy program in one sitting.
CCPA outline: the 8 sections that matter in 2026
1. Confirm whether the business is in scope
Start with applicability, not with banners or templates. The California Department of Justice still summarizes the law as applying to for-profit businesses that do business in California and meet at least one threshold tied to revenue, data volume, or revenue from selling personal information. That means a company can fall under the law because of audience scale or ad-tech behavior, not just because it is large.
A useful ccpa outline should name the entity or entities in scope, the products covered, and the business units that collect or share personal information.
2. Map the data and the purpose behind it
The next section should show what personal information you collect, where it comes from, why you collect it, and where it goes next. Without that, the rest of the program turns into guesswork.
This part matters more after California’s recent enforcement activity. In the General Motors settlement announced on May 8, 2026, Attorney General Rob Bonta said the company sold drivers’ data “without their knowledge or consent.” That is the risk of a weak inventory: data collected for one product reason later gets sold, shared, or reused in ways the original intake flow never made clear.
3. Check notices at collection and privacy policy content
Your outline should then move to disclosures. Covered businesses need the right notices, and those notices have to match what operations are actually doing.
That sounds obvious, but it is where programs drift. Product adds a new SDK. Marketing adds a new audience sync. Procurement signs a new vendor. The policy stays frozen. If your notice language and the real data flow have separated, the program is already slipping.
4. Document the consumer-rights workflow
The DOJ’s CCPA summary still points to the same core consumer rights: know, delete, correct, opt out of sale or sharing, and limit certain uses of sensitive personal information. A privacy outline should show how each request is received, verified, routed, completed, and logged.
This is the place to get specific. Which team owns deletion? Which system records correction? What happens if the request touches a vendor, a CRM, and an ad platform at the same time? If nobody can answer those questions clearly, the rights section is not operational yet.
5. Treat opt-out and GPC as their own control layer
California is not a blanket opt-in law for adults, but it is very clear on opt-out mechanics. The California DOJ says businesses that sell or share personal information must offer two or more methods for opt-out requests, and for businesses collecting information online, one acceptable method is a user-enabled Global Privacy Control signal.
That is why the opt-out section in your outline should stand on its own. It should cover web forms, account settings, app flows, partner suppression, and whether browser signals actually stop downstream sharing. Do not bury this inside a generic “cookie” workstream.
6. Mark the places where consent really is required
Most California privacy work is about notice, opt-out, and limit rights. Still, there are moments where affirmative permission matters, especially for minors and some other high-risk uses.
California enforcement history keeps underlining the design side of that problem. In the CPPA’s dark-patterns advisory, Deputy Enforcement Director Michael Macko said consumers should not have to act “without jumping through confusing hoops.” That is a sharp test for any consent or rights interface. If the privacy-protective path is harder, slower, or more confusing than the permissive one, the program needs work even if the wording looks polished.
7. Add the 2026 and 2027 timing layer
An outline that ignores timing is not much use. The CPPA’s final regulations went into effect on January 1, 2026. When the agency announced them in September 2025, General Counsel Phil Laird said they would “provide clarity for businesses.”
But the compliance calendar is staggered. Risk-assessment compliance began in 2026 for covered activities. Automated decisionmaking technology requirements begin on January 1, 2027. Cybersecurity-audit certification deadlines phase in later by revenue band. Separately, California’s data broker system now lets residents submit one deletion request through DROP, and registered data brokers must begin processing those requests on August 1, 2026.
8. End with enforcement proof, not policy prose
The last part of the outline should ask a blunt question: if California regulators looked at this program tomorrow, what evidence would you hand them?
Recent California enforcement has focused on whether privacy choices actually work across systems, whether minors’ data gets the right treatment, whether opt-outs are honored cleanly, and whether companies are using data beyond the context consumers were led to expect. That makes proof more important than aspiration. Keep records of notices, request handling, GPC behavior, suppression logic, vendor terms, and change management.
How to use this outline in practice
Run this ccpa outline as a quarterly review, not as a one-time launch document. Privacy programs usually fail in the gaps between teams: product changes something, marketing adds a destination, legal updates the text, and nobody checks whether the choices still line up.
If you can keep these eight sections current, you will have something much more useful than a policy page. You will have a working program map that tells your team what California expects now, what changes next, and where the real exposure sits.
Sources
- California Department of Justice CCPA FAQ
- California Department of Justice Global Privacy Control page
- California Privacy Protection Agency regulations announcement
- California Privacy Protection Agency Data Broker Registry and DROP information
- California Privacy Protection Agency dark patterns advisory
- California Department of Justice General Motors privacy settlement
- California Department of Justice privacy enforcement actions